CVE-2026-13009

MediumCVSS 6.5

Published: 23/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Summary

The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL injection via the 'order[0][dir]' parameter in versions up to 1.5.4. Authenticated attackers with subscriber-level access or higher can inject additional SQL queries and extract sensitive data.

Risk Assessment

The risk involves potential data leakage from the database by an attacker with low privileges, which could compromise confidentiality.

Recommendation

Update the plugin to the latest version and implement proper access controls for sensitive AJAX endpoints.

Other vulnerabilities in AI Copilot – Content Generator

CVE-2026-14526Critical
The AI Copilot – Content Generator plugin for WordPress up to version 1.5.6 has an authorization bypass vulnerability. Unauthenticated attackers can create an administrator account and take over the site by saving and executing a malicious workflow with wp_create_user. This is possible because the nonce is exposed in public JavaScript.

Original NVD description (English source)

The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The required waic-nonce is emitted on the front-end whenever the [waic_form] or [aiwu-form] shortcode is rendered, enabling contributor-level users who can publish shortcodes to obtain a valid nonce and reach the vulnerable AJAX handler, which performs no capability check beyond nonce verification when the shortcodes are not already embedded in a page.